“To ensure resilience, we need to understand what matters”

Resilience is built first and foremost around business challenges, by identifying risks, their impacts, and priorities in order to implement appropriate business continuity and disaster recovery measures.

Strengthening an organization's resilience is a business issue more than an IT issue. For Loris Rilli, Senior Advisory Consultant at Anidris x Easi, it is first and foremost necessary to understand the risks to which the business is exposed, their impacts, and the organization's priorities. Based on these elements, various measures can be considered and implemented, such as effective continuity and recovery plans, supported by backup and data management solutions, such as those offered by Cohesity.

Loris Rilli: NIS2, DORA, and more broadly the new regulatory requirements are pushing organizations to move from a largely reactive and control-focused logic to an approach that is more risk-based. Regulation acts as a catalyst. However, operational resilience cannot be limited to a matter of compliance. It must be considered at the heart of the company's strategy, by implementing, according to the principle of proportionality, measures that correspond to the risks incurred.

The availability requirement of a trading room, where transactions take place continuously, is not the same as that associated with a monthly reporting activity.

Yes. For a long time, the management of cybersecurity or resilience issues was entrusted to IT. Today, approaches are evolving. To ensure the company's resilience, it is necessary to understand what is truly important for the business, in order to determine the measures that must be implemented to guarantee the availability or restoration of essential functions.

IT must respond to a need defined by the business. The question of risk appetite, in particular, falls under the responsibility of management and the board. It is not something that IT can determine on its own. Technical measures must stem from these decisions, not the other way around.

Absolutely. Without this analysis, there is a tendency to want to protect everything according to the same criteria. This potentially leads to heavy and complex environments, without necessarily responding better to real priorities. Conversely, identifying what is essential makes it possible to focus resources and budgets where they truly bring value.

To do this, we carry out what is called a Business Impact Analysis, or BIA. This analysis goes beyond the RTO and RPO elements traditionally associated with backup policies. It seeks to understand how the impact of an interruption evolves over time and at what point that interruption becomes unacceptable for the organization.

A service may, for example, remain unavailable for several days with very few consequences, then become extremely critical starting on the fifth day. For another service, the impact may increase in a much more linear way. The BIA must make it possible to describe this behavior over time.

It is this understanding that then makes it possible to build coherent Business Continuity Plans, Disaster Recovery Plans, and Cyber Recovery Plans.

The objective is to maintain a minimum level of activity, even when IT is unavailable. A continuity plan must make it possible to buy time. In some activities, manual or alternative procedures allow operations to continue temporarily without the full range of IT services. In others, this is impossible.

The challenge therefore consists of knowing how to maintain essential services while technical teams work on a secure recovery. It is this articulation between business continuity, crisis management, and technological recovery that must be prepared.

For a long time, the objective of IT was mainly to bring the environment back as quickly as possible. However, when facing a compromise, speed is not always the first priority. If data has been compromised, replicating it synchronously across several environments solves nothing. Before putting a system back into production, it is necessary to determine what is healthy, identify the moment of compromise, and know with which data it is reasonable to restart.

Sometimes, management may even decide to temporarily accept a degraded situation in order to ensure a safer restoration in the long term.

No. That is why plans must be sufficiently agile to cover scenarios that have not been anticipated.

Within Anidris x Easi, we particularly recommend working with decision trees rather than procedures that simply need to be followed line by line. It is necessary to maintain an overall view, know who has the information, and above all who has the authority to make a given decision. It is a matter of governance as much as technology.

Backup and data management technologies are indispensable building blocks. Without a secure and usable copy, some recovery scenarios simply become impossible. However, the backup policy itself must stem from governance choices and priorities defined by the business. How long should data be retained? Which data must be restorable very quickly? What level of loss is acceptable for each service? Without an understanding of business needs, there is a risk of backing up an enormous amount of data and making the environment unnecessarily heavy, including at the time of recovery.

Data, certainly, is essential to the business, but it is not its ultimate purpose. It is a means of reactivating and bringing the organization's services back into operation. The question is not only how to recover data. It is necessary to know how the company will continue to operate, which services must be restored first, and under what conditions they can be restored safely.